@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/auth-cors.ts

@@ -30,6 +30,7 @@ import {
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   upstreamHttpVersionConfigError,
+  credentialPinnedProviderConfigError,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { providerEgressConfigError } from "../lib/provider-egress";
@@ -784,6 +785,8 @@ export function providerManagementConfigError(
     delete canonicalCandidate.pinnedReasoningEffort;
     delete canonicalCandidate.modelPinnedReasoningEfforts;
     delete canonicalCandidate.responsesSnapshotRepair;
+    // Explicit history-loss opt-in changes request content, never auth or transport identity.
+    delete canonicalCandidate.projectResponsesLiteHostedSearchHistory;
     // modelCosts is a user-owned display overlay, not part of the canonical
     // forward seed; it is validated separately below (providerModelCostsConfigError).
     delete canonicalCandidate.modelCosts;
@@ -912,6 +915,8 @@ export function providerManagementConfigError(
   if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
+  const credentialPinError = credentialPinnedProviderConfigError(name, typed);
+  if (credentialPinError) return `provider ${name} ${credentialPinError}`;
   const preferHostedToolsError = modelPreferHostedToolsConfigError(
     raw.modelPreferHostedTools,
     "modelPreferHostedTools",
@@ -919,12 +924,17 @@ export function providerManagementConfigError(
     typed,
   );
   if (preferHostedToolsError) return `provider ${name} ${preferHostedToolsError}`;
+  if (raw.projectResponsesLiteHostedSearchHistory !== undefined && typeof raw.projectResponsesLiteHostedSearchHistory !== "boolean") {
+    return `provider ${name} projectResponsesLiteHostedSearchHistory must be a boolean`;
+  }
   if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
     return `provider ${name} responsesSnapshotRepair must be a boolean`;
   }
   if (raw.xaiResponsesXSearch !== undefined && typeof raw.xaiResponsesXSearch !== "boolean") {
     return `provider ${name} xaiResponsesXSearch must be a boolean`;
   }
+  const minMaxOutputError = positiveIntegerConfigError(raw.minMaxOutputTokens, "minMaxOutputTokens");
+  if (minMaxOutputError) return `provider ${name} ${minMaxOutputError}`;
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");
   if (defaultMaxOutputError) return `provider ${name} ${defaultMaxOutputError}`;
   const maxOutputError = positiveIntegerRecordConfigError(raw.modelMaxOutputTokens, "modelMaxOutputTokens");
@@ -1051,9 +1061,12 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   preserveResponsesReasoningContent: "editor",
   preserveResponsesInputItemIds: "editor",
   preserveResponsesMessageMetadata: "editor",
+  projectResponsesLiteHostedSearchHistory: "editor",
   dropResponsesReasoningItems: "editor",
   modelReasoningEffortsAuthoritative: "editor",
   decodesNativeCompactionBlobs: "editor",
+  supportsNativeCompactionTrigger: "editor",
+  supportsNativeCompactEndpoint: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
   // A proxy URL routinely embeds `user:password@`, so it never reaches the dashboard DTO and
@@ -1085,6 +1098,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   newModelPolicy: "editor",
   modelPreset: "editor",
   contextWindow: "editor",
+  inferContextWindow: "editor",
   modelContextWindows: "editor",
   modelContextTiers: "editor",
   modelInputModalities: "editor",
@@ -1092,6 +1106,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   modelMaxInputTokens: "runtime",
   modelAutoCompactTokenLimits: "editor",
   defaultMaxOutputTokens: "editor",
+  minMaxOutputTokens: "editor",
   modelMaxOutputTokens: "editor",
   modelCosts: "editor",
   headers: "redacted",

package/src/server/chat-completions.ts

@@ -10,7 +10,9 @@ import {
   assertChatCompletionsRoutingBody,
   ChatCompletionsRequestError,
 } from "../chat/inbound";
-import { chatToResponsesBody } from "../protocols/codecs/chat";
+import { chatSettingsBody, chatToResponsesBody } from "../protocols/codecs/chat";
+import { chatConversationToIr, chatIrRouteEvidence, withDirectChatConversation, type ChatIrConversation } from "../protocols/codecs/chat-ir";
+import { antigravityDirectDeclineReason } from "./antigravity-direct-eligibility";
 import { normalizeChatImageParts } from "../chat/image-parts";
 import {
   chatCompletionsErrorResponse,
@@ -19,7 +21,8 @@ import {
   responsesJsonToChatCompletion,
   responsesSseToChatCompletionsSse,
 } from "../chat/outbound";
-import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { ADVISOR_INTERNAL_CAPABILITY_HEADER, isInternalCallCapability } from "../lib/local-internal-call-capability";
+import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, UNDECLARED_TOOL_CALL_ERROR_CODE } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import {
@@ -44,12 +47,14 @@ import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import {
   addFinalRequestLog,
+  cacheDiagnosticsObserving,
   httpStatusForRequestLogTerminal,
   recordFirstOutput,
   type RequestLogContext,
 } from "./request-log";
 import { createFinalRequestLog } from "./inference/final-log";
 import { clientWireLogOf, clientWireOf } from "./inference/client-wire";
+import { attachAdvisorReasoning } from "./inference/advisor-diagnostics";
 import { directEncodersApply } from "./inference/client-encoder-delivery";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
@@ -110,8 +115,10 @@ export async function handleChatCompletions(
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
+    let response = await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds);
+    if (isInternalCallCapability(req.headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER))) response = attachAdvisorReasoning(response, logCtx);
     return finalizeTranslatorBudgetResponse(
-      await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
+      response,
       translatorBudget,
       req.signal,
     );
@@ -272,6 +279,12 @@ async function handleChatCompletionsWithBudget(
   const protocolSettings = resolveProtocolSettings(config);
   const nativeChatCombos = protocolSettings.rollout.nativeChatCombos
     && settledRoute?.combo !== undefined && !effortRow;
+  // Antigravity direct lane (off by default): the conversation is decoded straight into the IR
+  // and the answer is encoded straight into Chat, with no internal Responses body either way.
+  const antigravityDecline = settledRoute && !chatNativeRoute
+    ? antigravityDirectDeclineReason(settledRoute, chatBody, config, { cacheDiagnostics: cacheDiagnosticsObserving() })
+    : undefined;
+  const directRoute = settledRoute && !chatNativeRoute && antigravityDecline === undefined ? settledRoute : null;
   const envelope = protocolSettings.unrepresentable === "reject" || nativeChatCombos
     ? createProtocolEnvelope({ inbound: "chat", body: chatBody, translatorBudget })
     : undefined;
@@ -281,7 +294,7 @@ async function handleChatCompletionsWithBudget(
       inbound: "chat",
       requestPath: chatNativeRoute
         ? requestPathForLane("chat", "native", "chat")
-        : requestPathForLane("chat", "bridge", upstreamWireForAdapter(settledRoute.provider.adapter)),
+        : requestPathForLane("chat", directRoute ? "direct" : "bridge", upstreamWireForAdapter(settledRoute.provider.adapter)),
       features: envelope.features(),
       policy: "reject",
     });
@@ -294,8 +307,15 @@ async function handleChatCompletionsWithBudget(
   }
   markProtocolEntry(logCtx, {
     inbound: "chat",
-    lane: chatNativeRoute ? "native" : "bridge",
-    reasonCodes: !chatNativeRoute && nativeDecline ? [nativeDecline] : [],
+    lane: chatNativeRoute ? "native" : directRoute ? "direct" : "bridge",
+    reasonCodes: [
+      ...(!chatNativeRoute && !directRoute && nativeDecline ? [nativeDecline] : []),
+      // Only a decline that says something about this route: with the switch off or a
+      // non-Antigravity target the path reason already explains the bridge.
+      ...(antigravityDecline && antigravityDecline !== "rollout-disabled" && antigravityDecline !== "not-migrated"
+        ? [antigravityDecline]
+        : []),
+    ],
     features: envelope ? () => envelope.features() : () => featuresFromChatBody(chatBody),
   });
   recordProtocolShadowPlan(logCtx, config, { inbound: "chat", model: requestedModel });
@@ -314,10 +334,18 @@ async function handleChatCompletionsWithBudget(
   }
 
   let internalBody: Rec;
+  let directConversation: ChatIrConversation | undefined;
   try {
     // Validate the full Chat boundary after routing. Native Chat keeps `chatBody` as
     // its wire source; this Responses projection is used only by the fallback path.
-    internalBody = chatToResponsesBody(chatBody);
+    // The direct lane validates the same boundary while decoding the conversation into the IR,
+    // and sends the core only the request settings.
+    if (directRoute) {
+      directConversation = chatConversationToIr(chatBody, chatBody.model as string);
+      internalBody = chatSettingsBody(chatBody);
+    } else {
+      internalBody = chatToResponsesBody(chatBody);
+    }
     if (effortRow) {
       internalBody.reasoning = {
         ...(isRec(internalBody.reasoning) ? internalBody.reasoning : {}),
@@ -370,6 +398,17 @@ async function handleChatCompletionsWithBudget(
   }
 
   const visionDescribeTerminal = req.headers.get("x-opencodex-vision-describe") === "1";
+  // Terminal advisor marker: the advisor sidecar's own loopback consultation re-enters through
+  // this surface. The bridge rebuilds headers from the FORWARD_HEADERS allowlist, which would
+  // drop the raw marker header — so the fact is detected here and carried as an option flag
+  // (same structure as the vision-describe fence above, depth cap 1).
+  //
+  // The header value is NOT evidence by itself: any external caller can send it, and the peer
+  // address proves nothing (Docker/WSL/tunnels/port-forwarding end on loopback). Internal
+  // authority comes from a process-owned capability minted at random per process and compared in
+  // constant time, so a forged header — or a token captured from an older process — is treated
+  // as an ordinary external request.
+  const advisorInternal = isInternalCallCapability(req.headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER));
   // Concrete helper targets must fail before optional stored-main credential enrichment.
   // Unresolved combos are checked after their concrete child route is selected in Responses.
   if (settledRoute && !settledRoute.combo && isCanonicalOpenAiForwardProvider(settledRoute.provider)
@@ -455,6 +494,10 @@ async function handleChatCompletionsWithBudget(
     abortSignal: req.signal,
     // Body is Responses-shaped by now, but the client spoke Chat Completions.
     inboundWire: "chat",
+    // A Chat caller may send an explicit empty `tools` array — a deny-all declaration the
+    // translation drops along with the whole catalog. Carried separately so the
+    // undeclared-tool guard can still enforce it; absent/partial catalogs stay deferred.
+    clientDeclaredEmptyToolCatalog: Array.isArray(chatBody.tools) && chatBody.tools.length === 0,
     ...((settledRoute?.combo || settledRoute?.routeKind === "policy") && droidDefaultEffort
       ? { droidDefaultEffort }
       : {}),
@@ -468,13 +511,35 @@ async function handleChatCompletionsWithBudget(
     // headers from the FORWARD_HEADERS allowlist, which would drop the raw
     // header — so the fact is detected here and carried as an option flag.
     ...(visionDescribeTerminal ? { visionDescribeTerminal: true } : {}),
+    ...(advisorInternal ? { advisorInternal: true } : {}),
     translatorBudget,
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForRequestLogTerminal(status, logCtx), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
-    ...(directEncodersApply(config, settledRoute)
-      ? { clientEncoder: { protocol: "chat" as const, stream, model: requestedModel } }
-      : {}),
+    // The direct lane answers through the direct encoder whatever `directEncoders` says: the
+    // point of the lane is that neither direction passes through the internal Responses body.
+    ...(directRoute && directConversation
+      ? {
+        clientEncoder: { protocol: "chat" as const, stream, model: requestedModel, requestLane: "direct" as const },
+        directRequest: {
+          protocol: "chat" as const,
+          providerName: directRoute.providerName,
+          modelId: directRoute.modelId,
+          evidence: chatIrRouteEvidence(directConversation),
+          decode: base => withDirectChatConversation(base, chatBody, directConversation!),
+          bridgeConversation: () => {
+            const bridge = chatToResponsesBody(chatBody);
+            return {
+              input: bridge.input,
+              ...(bridge.instructions !== undefined ? { instructions: bridge.instructions } : {}),
+              ...(bridge.tools !== undefined ? { tools: bridge.tools } : {}),
+            };
+          },
+        },
+      }
+      : directEncodersApply(config, settledRoute)
+        ? { clientEncoder: { protocol: "chat" as const, stream, model: requestedModel } }
+        : {}),
   });
   // Already in the Chat wire: no conversion. A direct-encoder body (PF-09) reports its own log
   // facts to the deferred request log. A native combo child (PF-07) carries none: its row is
@@ -539,10 +604,17 @@ async function handleChatCompletionsWithBudget(
       // below could never restore this one -- the translated client was told the provider
       // throttled the turn, and handed a two-second wait to send it again.
       classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
+    } else if (upstreamCode === "claude_subscription_cooldown") {
+      classified.code = "claude_subscription_cooldown";
+      classified.type = "rate_limit_error";
     } else if (upstreamCode === "model_not_found") {
       // Structured model_not_found must win over classifyError's generic remaps.
       classified.code = "model_not_found";
       classified.type = "invalid_request_error";
+    } else if (upstreamCode === UNDECLARED_TOOL_CALL_ERROR_CODE) {
+      // The guard's deterministic refusal keeps its wire identity — same code the
+      // streamed `response.failed` frame and the Anthropic surface carry.
+      classified.code = UNDECLARED_TOOL_CALL_ERROR_CODE;
     } else if (upstreamCode !== undefined && upstreamCode !== null && classified.code == null) {
       classified.code = upstreamCode;
     }

package/src/server/chat-native-reasoning.ts

@@ -0,0 +1,123 @@
+import type { OcxProviderConfig, OcxReasoningReplayScopeRef } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+import { chatReasoningReplayPolicy, isChatRecord } from "../adapters/openai-chat/reasoning-replay";
+import { bindReasoningReplayScope, reasoningReplayDestinationIdentity,
+  reasoningReplayKeyCredentialIdentity, rememberReasoningForCall } from "../responses/reasoning-replay-cache";
+import { reasoningReplayConversationIdFromResponsesRequest, sessionIdHeaderFromRequest } from "./request-log-conversation";
+
+type Rec = Record<string, unknown>;
+
+export function nativeChatReplayScope(headers: Headers): OcxReasoningReplayScopeRef | undefined {
+  const clientThreadId = reasoningReplayConversationIdFromResponsesRequest({
+    threadIdHeader: headers.get("thread-id"), sessionIdHeader: sessionIdHeaderFromRequest(headers),
+  });
+  return clientThreadId ? { clientThreadId } : undefined;
+}
+
+/** Rebind before EVERY build: a key rotation must not retrieve another credential's reasoning. */
+export function bindNativeChatReplayScope(
+  scope: OcxReasoningReplayScopeRef | undefined,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): void {
+  const providerDestinationIdentity = reasoningReplayDestinationIdentity(provider.baseUrl);
+  const credentialIdentity = reasoningReplayKeyCredentialIdentity(provider);
+  bindReasoningReplayScope(scope, providerDestinationIdentity && credentialIdentity ? {
+    providerName, modelId, adapterName: "openai-chat",
+    providerDestinationIdentity, credentialIdentity,
+  } : undefined);
+}
+
+/** Observe the native wire, never translate it or retain tool arguments/content. */
+export function nativeChatReasoningCapture(
+  provider: OcxProviderConfig,
+  modelId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+  budget: TranslatorBudget,
+) {
+  const choices = new Map<number, { text: string; calls: Map<number, string> }>();
+  const accounting = { kind: "retained_collectors" as const };
+  // This optional fallback cannot retain more than the cache it feeds (256 KiB / 64 calls).
+  const maxBytes = 256 * 1024;
+  let bytes = 0;
+  let callCount = 0;
+  let disabled = !scope?.current || !chatReasoningReplayPolicy(provider, modelId).preserve;
+  const discard = () => {
+    budget.releaseRetained(bytes, accounting);
+    bytes = 0;
+    choices.clear();
+    disabled = true;
+  };
+  const remember = (text: string, calls: Iterable<string>) => {
+    for (const id of calls) rememberReasoningForCall(id, text, scope);
+  };
+  const observe = (value: Rec) => {
+    if (disabled || !Array.isArray(value.choices)) return;
+    for (const [ordinal, raw] of value.choices.entries()) {
+      if (!isChatRecord(raw) || !isChatRecord(raw.delta)) continue;
+      const index = typeof raw.index === "number" ? raw.index : ordinal;
+      if (!choices.has(index)) {
+        if (choices.size >= 64) { discard(); return; }
+        choices.set(index, { text: "", calls: new Map() });
+      }
+      const state = choices.get(index)!;
+      const delta = raw.delta;
+      const append = (previous: string, fragment: string): string | undefined => {
+        const added = Buffer.byteLength(fragment) * 2;
+        if (bytes + added > maxBytes) { discard(); return undefined; }
+        // Account the new retained fragment before concatenation; the transient reservation
+        // covers the old string while its replacement is allocated.
+        const reservation = budget.reserveTransient(Buffer.byteLength(previous) * 2, accounting);
+        try {
+          budget.chargeRetained(added, accounting);
+          bytes += added;
+          return previous + fragment;
+        } finally { reservation.release(); }
+      };
+      if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+        const text = append(state.text, delta.reasoning_content);
+        if (text === undefined) return;
+        state.text = text;
+      }
+      if (Array.isArray(delta.tool_calls)) {
+        for (const [toolOrdinal, tool] of delta.tool_calls.entries()) {
+          if (!isChatRecord(tool) || typeof tool.id !== "string" || tool.id.length === 0) continue;
+          const toolIndex = typeof tool.index === "number" ? tool.index : toolOrdinal;
+          if (!state.calls.has(toolIndex)) {
+            if (callCount >= 64) { discard(); return; }
+            callCount += 1;
+          }
+          const previous = state.calls.get(toolIndex) ?? "";
+          if (previous === tool.id) continue;
+          const id = append(previous, tool.id);
+          if (id === undefined) return;
+          state.calls.set(toolIndex, id);
+        }
+      }
+      // The completed choice is valid even if a caller dispatches its tool before [DONE].
+      if (typeof raw.finish_reason === "string" && raw.finish_reason.length > 0) {
+        remember(state.text, state.calls.values());
+      }
+    }
+  };
+  return {
+    observe,
+    finish(success: boolean) {
+      if (success && !disabled) {
+        for (const state of choices.values()) remember(state.text, state.calls.values());
+      }
+      discard();
+    },
+    json(value: Rec) {
+      if (disabled || !Array.isArray(value.choices)) return;
+      for (const choice of value.choices) {
+        if (!isChatRecord(choice) || !isChatRecord(choice.message)) continue;
+        const message = choice.message;
+        if (typeof message.reasoning_content !== "string" || !Array.isArray(message.tool_calls)) continue;
+        remember(message.reasoning_content, message.tool_calls.filter(isChatRecord)
+          .flatMap(tool => typeof tool.id === "string" ? [tool.id] : []));
+      }
+    },
+  };
+}

package/src/server/chat-native-sse.ts

@@ -1,5 +1,5 @@
 import { chatCompletionsErrorBody } from "../chat/outbound";
-import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, UNDECLARED_TOOL_CALL_ERROR_CODE } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import {
   isTranslatorBudgetExceededError,
@@ -16,6 +16,39 @@ function isRec(value: unknown): value is Rec {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+export const UNDECLARED_CHAT_TOOL_MESSAGE = "Upstream emitted a client tool call outside this request's declared tool catalog.";
+
+function* chatToolCalls(value: Rec): Generator<{ key: string; name: string; snapshot: boolean; invalid?: boolean }> {
+  const choices = Array.isArray(value.choices) ? value.choices : [];
+  for (const [position, choice] of choices.entries()) {
+    if (!isRec(choice)) continue;
+    const choiceIndex = typeof choice.index === "number" ? choice.index : position;
+    for (const [payload, snapshot] of [[choice.delta, false], [choice.message, true]] as const) {
+      if (!isRec(payload)) continue;
+      const tools = Array.isArray(payload.tool_calls) ? payload.tool_calls : [];
+      for (const [index, tool] of tools.entries()) {
+        const fn = isRec(tool) && isRec(tool.function) ? tool.function : {};
+        const toolIndex = isRec(tool) && typeof tool.index === "number" ? tool.index : index;
+        yield {
+          key: `${choiceIndex}:tool:${toolIndex}`, name: typeof fn.name === "string" ? fn.name : "", snapshot,
+          invalid: !isRec(tool) || (tool.type !== undefined && tool.type !== "function"),
+        };
+      }
+      if (payload.function_call !== undefined && payload.function_call !== null) {
+        const fn = isRec(payload.function_call) ? payload.function_call : {};
+        yield { key: `${choiceIndex}:legacy`, name: typeof fn.name === "string" ? fn.name : "", snapshot };
+      }
+    }
+  }
+}
+
+export function chatResponseHasUndeclaredToolCalls(value: Rec, declared: ReadonlySet<string>): boolean {
+  for (const call of chatToolCalls(value)) {
+    if (call.invalid || !declared.has(call.name)) return true;
+  }
+  return false;
+}
+
 export function usageFromChat(value: unknown): OcxUsage | undefined {
   if (!isRec(value)) return undefined;
   const prompt = typeof value.prompt_tokens === "number" ? value.prompt_tokens : undefined;
@@ -134,8 +167,11 @@ interface NativeChatSseOptions {
    * `stallTimeoutSec` then resolves to disabled so a slow local model is not cut mid-turn.
    */
   localUpstream?: boolean;
+  clientDeclaredEmptyToolCatalog?: boolean;
+  declaredLegacyFunctionNames?: ReadonlySet<string>;
   onFirstOutput?: () => void;
   onUsage: (usage: OcxUsage) => void;
+  onChunk?: (value: Rec) => void;
   onTerminal?: (status: number, message?: string) => void;
   onCancel?: () => void;
 }
@@ -154,6 +190,29 @@ export function nativeChatSse(
     }
   });
   let queuedBytes = 0;
+  const declared = options.declaredLegacyFunctionNames ?? new Set<string>();
+  const toolNames = new Map<string, string>();
+  const pendingToolNames = new Set<string>();
+  const heldFrames: string[] = [];
+  let heldBytes = 0;
+  let toolNameBytes = 0;
+  const hasPendingToolName = () => pendingToolNames.size > 0;
+  const inspectToolCalls = (value: Rec): boolean => {
+    for (const call of chatToolCalls(value)) {
+      if (call.invalid) return false;
+      const previous = toolNames.get(call.key);
+      const name = call.snapshot ? call.name : (previous ?? "") + call.name;
+      if (!declared.has(name) && ![...declared].some(allowed => allowed.startsWith(name))) return false;
+      const bytes = previous === undefined ? 128 + Buffer.byteLength(call.key) * 2 + Buffer.byteLength(name) * 2
+        : Math.max(0, Buffer.byteLength(name) - Buffer.byteLength(previous)) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      toolNameBytes += bytes;
+      toolNames.set(call.key, name);
+      if (declared.has(name)) pendingToolNames.delete(call.key);
+      else pendingToolNames.add(call.key);
+    }
+    return true;
+  };
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
@@ -191,7 +250,31 @@ export function nativeChatSse(
       throw error;
     }
   };
-  const releaseBuffer = () => buffer.clear();
+  const releaseHeld = () => {
+    options.translatorBudget.releaseRetained(heldBytes, scope);
+    heldBytes = 0;
+    heldFrames.length = 0;
+  };
+  const relay = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
+    if (hasPendingToolName()) {
+      const bytes = Buffer.byteLength(text) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      heldBytes += bytes;
+      heldFrames.push(text);
+      return;
+    }
+    for (const frame of heldFrames) enqueue(controller, frame);
+    releaseHeld();
+    enqueue(controller, text);
+  };
+  const releaseBuffer = () => {
+    buffer.clear();
+    releaseHeld();
+    options.translatorBudget.releaseRetained(toolNameBytes, scope);
+    toolNameBytes = 0;
+    toolNames.clear();
+    pendingToolNames.clear();
+  };
   const settle = (status: number, message?: string) => {
     if (settled) return;
     settled = true;
@@ -206,12 +289,12 @@ export function nativeChatSse(
     type = "upstream_error",
   ) => {
     const safeMessage = redactSecretString(message);
+    releaseBuffer();
     try {
       const frame = `data: ${JSON.stringify(chatCompletionsErrorBody(status, safeMessage, type, code))}\n\n`;
       if (code === "translation_buffer_limit") controller.enqueue(encoder.encode(frame));
       else enqueue(controller, frame);
     } catch { /* controller may already be closed */ }
-    releaseBuffer();
     settle(status, safeMessage);
     try { void reader.cancel(new Error(safeMessage)).catch(() => {}); } catch { /* already closed */ }
     try { controller.close(); } catch { /* already closed */ }
@@ -224,16 +307,20 @@ export function nativeChatSse(
     const payload = sseDataPayload(block);
     if (payload === null) {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     const trimmed = payload.trim();
     if (trimmed === "") {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     if (trimmed === "[DONE]") {
+      if (hasPendingToolName()) {
+        fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+        return;
+      }
       sawDone = true;
       enqueue(controller, replaceSseDataPayload(block, "[DONE]") + delimiter);
       releaseBuffer();
@@ -272,9 +359,20 @@ export function nativeChatSse(
       return;
     }
     const usage = usageFromChat(parsed.usage);
+    options.onChunk?.(parsed);
     if (usage) options.onUsage(usage);
+    if (options.clientDeclaredEmptyToolCatalog && !inspectToolCalls(parsed)) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
+    if (hasPendingToolName() && choices.some((choice, position) => isRec(choice)
+      && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0
+      && [...pendingToolNames].some(key => key.startsWith(`${typeof choice.index === "number" ? choice.index : position}:`)))) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     if (finished) sawFinish = true;
     const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
@@ -302,11 +400,11 @@ export function nativeChatSse(
     const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
-    if (!firstOutput && hasProgress) {
+    if (!firstOutput && hasProgress && !hasPendingToolName()) {
       firstOutput = true;
       options.onFirstOutput?.();
     }
-    enqueue(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
+    relay(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
   };
 
   function onAbort() {
@@ -336,6 +434,7 @@ export function nativeChatSse(
           if (next) {
             buffer.compact();
             processBlock(controller, next.block, next.delimiter);
+            if (heldFrames.length > 0 && !settled) continue;
             return;
           }
           if (performance.now() >= pullDeadline) throw stalled;
@@ -370,6 +469,10 @@ export function nativeChatSse(
             continue;
           }
           buffer.append(decoder.decode());
+          if (hasPendingToolName()) {
+            fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+            return;
+          }
           if (buffer.tail().trim().length > 0) {
             fail(controller, "upstream SSE ended with an unterminated event", "upstream_sse_unterminated");
             return;